ISO 27001 Gap Assessment Explained
Short answer: An ISO 27001 gap assessment is a structured comparison of your current information security practices against the requirements of ISO/IEC 27001:2022 — both the mandatory clauses (4–10) and the applicable controls in Annex A. The output is a prioritised list of gaps, a compliance percentage, and an implementation roadmap. It is the starting point for any ISO 27001 project.
TL;DR: A gap assessment tells you where you are before you decide where you need to go. Without one, you risk over-investing in areas already covered while leaving critical gaps open until a certification auditor finds them. In our readiness engagements, a well-run gap assessment typically takes two to four weeks and saves months of rework later.
Key Takeaways - A gap assessment covers both mandatory clauses (4–10) and Annex A controls (93 controls across four themes in the 2022 version). - The output should include a compliance percentage per clause/theme, a prioritised gap list, and a recommended remediation roadmap. - Gap assessments are distinct from certification audits — they are internal planning tools, not official conformity assessments. - The transition from ISO 27001:2013 required organisations to map old controls to the 2022 Annex A — a gap assessment is how that mapping is documented. - ISO 27001:2022 added 11 new controls; any existing ISMS must assess coverage of these specifically.
On this page
- What a gap assessment is — and what it is not
- The two dimensions of a gap assessment
- How to conduct a gap assessment
- Gap assessment vs risk assessment
- Using results to plan the implementation
- Frequently asked questions
What a gap assessment is — and what it is not
A gap assessment (also called a gap analysis or readiness assessment) is an internal or consultant-led exercise that compares your current state against the target standard. It does not produce a certificate, and it is not conducted by an accredited certification body.
Its purpose is planning: understanding the scope of work required to achieve certification, identifying where effort should be prioritised, and avoiding surprises during the formal Stage 2 audit.
Contrast this with a certification audit, which is conducted by an accredited third party to formally verify conformity. The gap assessment feeds the implementation work; the certification audit validates the result. For a full comparison, see ISO 27001 internal audit vs certification audit.
The two dimensions of a gap assessment
Dimension 1: Mandatory clauses (4–10)
The mandatory clauses define the management system structure. The assessment must verify whether your organisation has:
| Clause | Requirement | Common gap |
|---|---|---|
| 4 — Context | Identified internal/external issues; mapped interested parties and their requirements | Not documented; informal understanding only |
| 5 — Leadership | Top management committed; security policy approved and communicated; roles and responsibilities assigned | Policy exists but is outdated or not approved at board level |
| 6 — Planning | Risk assessment process defined; risk treatment plan produced; Statement of Applicability drafted | Risk register not connected to treatment decisions |
| 7 — Support | Resources, competence, awareness, communication, and documentation managed | Training records not maintained; no document control |
| 8 — Operation | Risk assessment and treatment implemented; operational controls documented | Controls exist but not documented; no change management process |
| 9 — Performance | Internal audits conducted; management review held; metrics tracked | No formal audit programme; management review is ad hoc |
| 10 — Improvement | Nonconformities identified and corrected; continual improvement documented | No corrective action tracking; lessons learned not captured |
Dimension 2: Annex A controls (93 controls)
Annex A provides the control set. The Statement of Applicability (SoA) documents which controls apply and why; the gap assessment evaluates the current implementation status of each applicable control. The 93-control count and the clause structure (Clauses 4–10 plus Annex A) are defined in the published standard (ISO/IEC 27001:2022, iso.org).
The 2022 version reorganises controls into four themes:
| Theme | Controls | Examples of new/changed controls |
|---|---|---|
| Organisational | 37 | Threat intelligence (A.5.7); Cloud security (A.5.23); Data leakage prevention mapping |
| People | 8 | Remote working; information security awareness |
| Physical | 14 | Physical security monitoring; securing offices/equipment |
| Technological | 34 | Secure coding (A.8.28); Data masking (A.8.11); Web filtering (A.8.23) |
For each applicable control, the gap assessment assigns a maturity or implementation status — typically on a 0–4 scale or using a traffic-light rating.
How to conduct a gap assessment
Step 1: Define scope
The gap assessment must cover the same scope as your intended ISMS. If your ISMS will cover only your software development function, assess only that function's people, processes, and technology. Scope creep in the assessment creates misleading results.
Step 2: Collect evidence
Evidence collection takes multiple forms:
- Document review: examine existing policies, procedures, audit reports, training records, system configurations, and vendor contracts.
- Interviews: speak with process owners, IT staff, HR, legal, and senior management. What people believe exists and what is documented often differ.
- Technical review: spot-check access controls, logging, patch status, and encryption on key systems. You do not need a full technical audit, but you need enough evidence to rate each control credibly.
Step 3: Rate each requirement
For each clause requirement and Annex A control, assign a rating:
| Rating | Meaning |
|---|---|
| 0 — Not implemented | No evidence of the control or requirement being addressed |
| 1 — Partial | Some activity exists but incomplete, undocumented, or inconsistently applied |
| 2 — Largely implemented | Implemented and documented, but gaps in effectiveness or coverage |
| 3 — Fully implemented | Implemented, documented, operating, and evidenced consistently |
Aim for an evidence-based rating, not a self-assessment by the process owner alone.
Step 4: Analyse and prioritise gaps
Group gaps by clause and control theme. Calculate a compliance percentage per area. Prioritise gaps using two criteria:
- Certification blocker: a gap in a mandatory clause (especially Clauses 4, 5, 6, 9, and 10) will prevent certification regardless of Annex A coverage.
- Risk relevance: gaps in controls directly related to your highest information security risks should be addressed early in the implementation.
Step 5: Produce the gap assessment report
The gap assessment report should contain:
- Executive summary: overall compliance percentage, key risks, and recommended timeline.
- Clause-by-clause findings: compliance rating and specific gaps per clause.
- Annex A findings: compliance rating per control theme, with individual control gaps flagged.
- Prioritised gap list: ordered by certification criticality and risk relevance.
- Remediation roadmap: recommended sequencing, effort estimates, and owners.
Gap assessment vs risk assessment
These two exercises are related but distinct. The gap assessment establishes your ISMS maturity against the standard. The risk assessment identifies the specific information security risks your organisation faces. Both are required for ISO 27001, and both should inform the control selection in your Statement of Applicability.
Run the gap assessment first: it tells you what processes and controls exist. The risk assessment then identifies what risks those existing controls leave open and what additional controls are needed.
Using results to plan the implementation
The gap assessment output feeds directly into your implementation plan:
- Clauses rated 0 or 1 are the first development items — the mandatory structure must be in place before Annex A controls are audited.
- Annex A gaps rated by risk relevance determine the sequencing of control implementation.
- The overall percentage gives you a realistic sense of how long Phase 4 (implementation) will take — typically 60–80% at the start of implementation is a good starting position; below 40% suggests a longer timeline.
For the full implementation sequence, see the ISO 27001:2022 implementation roadmap.
Frequently asked questions
How long does an ISO 27001 gap assessment take?
In our experience guiding organisations through readiness work, a thorough gap assessment for a medium-sized organisation covering both mandatory clauses and all applicable Annex A controls typically takes two to four weeks, including interviews, document review, and report drafting. The standard itself does not set a duration; this is a practitioner estimate, and timelines vary with scope and existing maturity.
Should a gap assessment be done internally or by a consultant?
Either works. An internal assessment is lower cost and uses existing knowledge of the organisation. A consultant brings independence, benchmark data from other organisations, and experience of what auditors look for. Many organisations do a combination: internal team conducts initial review; consultant validates and adds external perspective.
What is the difference between a gap assessment and an internal audit?
A gap assessment is a planning tool used before or at the start of implementation. An internal audit (Clause 9.2) is a formal management system control — it verifies that the ISMS is operating as intended against the standard's requirements. Both use similar techniques, but an internal audit produces formal findings and drives corrective action within the management system.
Does a gap assessment guarantee passing the certification audit?
No. A gap assessment identifies gaps and informs remediation. Whether you pass the certification audit depends on how thoroughly you close those gaps and whether your ISMS is operating effectively at the time of the Stage 2 audit.
ThreatBlock's ISO 27001:2022 Readiness course walks you through conducting a gap assessment, interpreting the results, and building a prioritised implementation plan.
About the author: Samaksh is Lead Instructor at ThreatBlock and holds the OSCP, CRTP, CRTO, and CEH certifications, with expertise in cybersecurity compliance and risk management. Read more on the author page · Editorial policy.